Arbitrary Code Execution in OpenVPN Connect by OpenVPN
CVE-2021-3613

7.8HIGH

Key Information:

Vendor
Openvpn
Status
Openvpn Connect
Vendor
CVE Published:
2 July 2021

Summary

The vulnerability in OpenVPN Connect versions 3.2.0 to 3.3.0 allows local users to exploit a flaw in OpenSSL configuration files, leading to the unauthorized loading of dynamic libraries. This could result in the execution of arbitrary code with the same privileges as the OpenVPN process, potentially compromising the system's security.

Affected Version(s)

OpenVPN Connect 3.2.0 up to 3.3.0

References

https://openvpn.net/vpn-server-resources/openvpn-connect-...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.